ClawHub
Back to skill

Security audit

Personal Budget Planner

Security checks across malware telemetry and agentic risk

Overview

This skill provides local, informational budgeting guidance and does not show evidence of hidden access, persistence, transactions, or data exfiltration.

Install only if you want local, informational budgeting templates and simple heuristic recommendations. Treat outputs as general guidance, not professional financial, tax, or legal advice, and avoid sharing more sensitive financial detail than needed because the skill is designed to analyze user-provided numbers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The module docstring materially understates the skill's behavior by claiming it only provides templates/frameworks, while the code actually parses user input and produces personalized budget analysis and recommendations. This kind of capability misrepresentation can bypass user or platform expectations, weaken risk review, and cause people to rely on outputs as tailored financial guidance despite the 'descriptive only' framing.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger scope extends well beyond personal budgeting into broader financial analysis tasks like receivables aging, invoice compliance, pricing strategy, tax deductions, and financial reports. This can cause the skill to be invoked in contexts it is not designed for, increasing the chance of misleading guidance, domain overreach, or unsafe handling of regulated or higher-stakes financial topics.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger list includes generic terms like "personal," "budget," and "planner," which are common in normal conversation and likely to cause unintended invocation or routing collisions with other skills. In a finance-related skill, accidental activation can expose users to irrelevant budgeting guidance when they did not explicitly request it, reducing reliability and creating opportunity for prompt hijacking through ambiguous matching.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.